Ensure that the SCTP iterator runs with an stcb and inp, which belong to
each other. Reported by: syzbot+82d39d14f2f765e38db0@syzkaller.appspotmail.com MFC after: 3 days
This commit is contained in:
parent
a93817e04f
commit
83ed508055
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=360885
@ -1489,6 +1489,7 @@ sctp_iterator_work(struct sctp_iterator *it)
|
||||
}
|
||||
tinp = it->inp;
|
||||
it->inp = LIST_NEXT(it->inp, sctp_list);
|
||||
it->stcb = NULL;
|
||||
SCTP_INP_RUNLOCK(tinp);
|
||||
if (it->inp == NULL) {
|
||||
goto done_with_iterator;
|
||||
@ -1558,6 +1559,9 @@ sctp_iterator_work(struct sctp_iterator *it)
|
||||
atomic_add_int(&it->stcb->asoc.refcnt, -1);
|
||||
iteration_count = 0;
|
||||
}
|
||||
KASSERT(it->inp == it->stcb->sctp_ep,
|
||||
("%s: stcb %p does not belong to inp %p, but inp %p",
|
||||
__func__, it->stcb, it->inp, it->stcb->sctp_ep));
|
||||
|
||||
/* run function on this one */
|
||||
(*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
|
||||
@ -1590,6 +1594,7 @@ sctp_iterator_work(struct sctp_iterator *it)
|
||||
} else {
|
||||
it->inp = LIST_NEXT(it->inp, sctp_list);
|
||||
}
|
||||
it->stcb = NULL;
|
||||
if (it->inp == NULL) {
|
||||
goto done_with_iterator;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user